Pillow is a popular Python imaging library that includes an XBM image file parser. A back‑tracking regular expression in XbmImageFile._open processes the XBM header before the image’s dimensions are validated. An attacker can supply a small, crafted XBM file that causes the expression to consume excessive CPU time, stalling Image.open() for minutes and denying service to the worker that performs the call. The flaw is mapped to CWE‑1333 and results in a denial of service condition for any process that opens the malicious file.

This vulnerability affects any installation of the python‑pillow Pillow library with a version earlier than 13.0.0. All users who load unpatched code—regardless of the deployment environment—are susceptible if they accept or open XBM files. Upgrading to Pillow 13.0.0 or later removes the problematic regular expression and mitigates the issue.

The CVSS score of 6.9 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an application that calls Pillow’s Image.open() on an XBM file supplied by an attacker. The most likely vectors are services or scripts that process untrusted XBM input locally or over a network, though no confirmed remote code execution or privilege escalation has been reported. The primary risk is resource exhaustion leading to denial of service.